{"id":9782,"date":"2024-07-24T12:16:50","date_gmt":"2024-07-24T19:16:50","guid":{"rendered":"https:\/\/www.microsoft.com\/insidetrack\/blog\/?p=9782"},"modified":"2024-10-28T11:04:17","modified_gmt":"2024-10-28T18:04:17","slug":"azure-resource-inventory-helps-manage-operational-efficiency-and-compliance","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/insidetrack\/blog\/azure-resource-inventory-helps-manage-operational-efficiency-and-compliance\/","title":{"rendered":"Azure resource inventory helps manage operational efficiency and compliance"},"content":{"rendered":"
One of the benefits of Microsoft Azure is the ease and speed in which cloud resources and infrastructure can be created or changed. Teams across Microsoft can scale up or scale down their cloud resources to meet their workload demands by adding or removing compute, storage, and network resources.<\/p>\n
Microsoft Digital has developed tools and processes that help us effectively manage physical IT assets and resources. But with the increase in cloud resources comes some unique challenges. Conventional processes weren\u2019t adequately giving us visibility into self-provisioned usage and related risks. Teams and business units at Microsoft could acquire cloud resources on behalf of the organization without passing through the traditional controls that give us some level of oversight and governance.<\/p>\n
The adoption of self-service cloud technologies was making it difficult for us to keep up with rapid changes. We needed better visibility into Azure resource utilization for individual employees, groups, and roles. To improve our ability to manage Azure resources and to help ensure compliance, we developed processes to help us:<\/p>\n
In a cloud environment, performance and availability of business workloads are often addressed by initially overestimating the compute and storage resources required. We didn\u2019t have visibility to collect usage data or to determine whether the resources required to run an application were in alignment with the demand or needs of the business. To be more efficient with resources, we needed a way to identify underutilized capacity, dormant or orphaned resources, and other undesirable artifacts that can lead to increased costs and unnecessary risk or complexity. Our starting point in addressing the challenge was to gather and maintain an accurate inventory of the resources within Azure to help ensure that the proper controls are practiced, optimize resources, and mitigate unsanctioned cloud use.<\/p>\n
As an IT organization, we can\u2019t manage risks that we can\u2019t see. We require visibility into our environment to help us effectively measure, manage, and protect our infrastructure and systems. For our behavior-based Security Incident and Event Management (SEIM) systems to perform their functions, they rely on an accurate view into IT infrastructures. When assessing compliance, security, cost-effectiveness, efficiency, troubleshooting, or other important functions, we need the capability to view and delve into every resource to determine its purpose, who can access it, and its value to the business.<\/p>\n
Understanding the risk and usage profiles of both sanctioned and unsanctioned Azure cloud resources requires the collection of accurate Azure resource and usage information\u2014they\u2019re necessary for correlating risks and behaviors. Implementing appropriate controls and a method to monitor for unsanctioned usage helps us reduce the risks associated with unsanctioned and unknown cloud resources. Those risks include:<\/p>\n
Just about everything in Azure that\u2019s associated with an account or a subscription is considered a resource. There can be thousands of resources used for a single Azure deployment, including virtual machines, Azure Blob storage, address endpoints, virtual networks, websites, databases, and third-party services.<\/p>\n
To be able to produce a comprehensive inventory, we needed to be able to answer the following questions about all of the Azure resources in use across the organization:<\/p>\n
We\u2019re responsible for managing the on-premises and cloud resources in our environment at Microsoft. Because cloud services are self-service and constantly changing, we needed to ensure that any methodology that we created to inventory Azure resources was agile enough to keep pace.<\/p>\n
We designed an Azure inventory solution that would collect subscription information from our internal billing system, resource and usage data from Azure Resource Manager, and store it in an Azure SQL database. The collected data could then be audited and reported on.<\/p>\n